CVE-2026-31792

Published: Mar 10, 2026Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: security-advisories@github.com (Secondary)

Description

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Prior to 2.3.1.5, there is a null pointer dereference in CIccTagXmlStruct::ParseTag() causing a segmentation fault or denial of service. This vulnerability is fixed in 2.3.1.5.

Affected (1)

Products: Color: Iccdev

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Color Iccdev	Before 2.3.1.5

Related CWEs

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (4)

https://github.com/InternationalColorConsortium/iccDEV/issues/633

Source: security-advisories@github.com

Issue Tracking

https://github.com/InternationalColorConsortium/iccDEV/pull/639

Source: security-advisories@github.com

Issue TrackingPatch

https://github.com/InternationalColorConsortium/iccDEV/releases/tag/v2.3.1.5

Source: security-advisories@github.com

Product

https://github.com/InternationalColorConsortium/iccDEV/security/advisories/GHSA-j3mh-rjg5-8gw7

Source: security-advisories@github.com

PatchVendor Advisory

Timeline

No history available yet.